Your Network Expects the Handshake to Fit in One Packet

Every secure connection
starts with a hello.

The client says
which versions it speaks,
which ciphers it likes,
which site it wants,
and offers its half
of a key exchange.

For years
that hello was small.

A few hundred bytes.

Well inside one packet.

Some code noticed
and started depending on it.

A firewall that reads the site name
from the first packet
and decides where to send the connection.

A load balancer
that does the same.

A proxy
that peeks at the hello
with a single read
into a fixed size buffer.

A server
with a parser written in a hurry.

None of that was ever promised.

All of it worked.

Now the hello is growing.

Browsers and large providers
have started sending
a second key exchange alongside the old one,
built to resist the quantum computers
people are planning for.

Its public key
is more than a kilobyte by itself.

The hello now runs
to more than fifteen hundred bytes,
past what fits in a typical packet.

So it arrives in two.

Code that read the first packet
and assumed it had everything
sees a hello cut in half.

Some reject it.

Some hang,
waiting for something they already got.

Some drop the connection
in a way that looks
like a network fault.

When the browsers first switched it on,
exactly this broke
in real servers and real boxes,
and some sites became unreachable
to some visitors,
depending on what sat in between.

And this is only the first step.

The signatures inside certificates
are due to change next,
and the new ones are larger again.

So a connection
will carry kilobytes
where it used to carry hundreds of bytes.

Anything with a size assumption
will be found.

So find it first.

Ask your vendors
whether their boxes reassemble the hello
before they inspect it.

Read your own parsers
for a single read
that expects the whole thing.

Then test with a large hello today.

Recent TLS libraries
can offer the new key exchange.

Point one at every entry point you run,
through every firewall and proxy,
and see which ones answer.

A limit nobody wrote down
is still a limit.

It just waits for the traffic
to grow into it.

– Serguey Asael Shinder